Overview

overview

10

Static

static

10

windowsfir...ed.exe

windows7-x64

10

windowsfir...ed.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    windowsfirewall-cleaned-cleaned.exe

  • Size

    269KB

  • MD5

    c333e63d128e050654fbb449b7181025

  • SHA1

    efae10124243d73c53f39e9b6e06034a0b6bccdf

  • SHA256

    a76c3667e10e44f6c0e25f34551145a74a37467de7523d51147ae13867471c49

  • SHA512

    4408f8d4ed4c1f023d1e1941eef44b1e7a107db5deb316f289816469184b102295769cbb40e04a86e0213f43e738b65053c6a6e7e92a5278c83e2052ec821599

  • SSDEEP

    6144:og6Hn50pvLHC/9UstNtNtNt5Z69Agb9IscS:Qn5wYZ/s5

Score
10/10
firewall.mscquasar

Malware Config

Extracted

Family

quasar

Version

1.4.0.0

Botnet

firewall.msc

C2

xmarvel.ddns.net:4782

Mutex

Z3hikKeJ9QsXRajr05

Attributes
  • encryption_key

    Y2QlNznzjD82S0MqUbBi

  • install_name

    wf.exe

  • log_directory

    Logs

  • reconnect_delay

    1

  • startup_key

    windowsfirewall

  • subdirectory

    WindowsFirewall

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs

Files

  • windowsfirewall-cleaned-cleaned.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections